🚨 [security] Update markdown-it 14.2.0 → 14.3.2 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ markdown-it (14.2.0 → 14.3.2) · Repo · Changelog

Security Advisories 🚨

🚨 markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

Summary

Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads.

src/rules_core/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each time. A paragraph of N soft-broken lines is one inline token with about 2N children, so you get N rebuilds over a 2N array. Schema-less emails are what reach it. A http:// link gets consumed by the inline rule first and never arrives as a text token, so those stay linear.

src/rules_inline/linkify.ts runs state.pending.match(SCHEME_RE) at every :// in the source. state.pending only gets truncated once a link is actually produced, so an unregistered scheme leaves it growing and every :// rescans the lot.

Proof of concept

Clean install of 15.0.0 from npm, new MarkdownIt({ linkify: true }).render(payload), Node 24.

N	5,000	10,000	20,000	40,000
'a@b.co\n'.repeat(N), 34KB to 273KB	1.1s	4.7s	19.6s	89s
'a://'.repeat(N), 20KB to 156KB	0.25s	0.76s	3.1s	15.0s

Doubling the input roughly quadruples the time in both. With linkify: false the same inputs run in 25 to 131ms and stay flat.

Controls for the first one, all at N=20000: putting every email in a single text token ('a@b.co ') takes 0.59s, one email per paragraph ('a@b.co\n\n') takes 0.64s, and soft-broken lines with nothing linkifiable take 42ms. So it needs many children AND many of them linkifying. For the second, replaying just the SCHEME_RE calls against the same growing prefixes with no markdown-it involved accounts for 11.7s of the 15s.

Ordinary prose does it too. 'ping a@b.co ok\n'.repeat(20000) is 293KB and takes 31s.

Caveat

linkify is off by default, so this only reaches apps that turn it on.

Impact

Availability only. A few hundred KB of fairly ordinary markdown pins one core for tens of seconds, and because it's quadratic it degrades quickly with size. Nothing is read, written or executed.

Release Notes

14.3.0 (from changelog)

Changed

• Reworked build pipeline & tools.
• Added source maps.
• Bumped linkify-it to 5.0.2.

Fixed

• Preserve backslash-space hard line breaks, matching CommonMark 6.7, #1185.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 41 commits:

• 14.3.2 released
• Backported 15.0.2 fixes
• 14.3.1 released
• Backported 15.0.1 fixes
• Ignore generated API docs in lint
• Prepare package.json for v14 backports
• fix: recognize lowercase declarations as HTML blocks (CommonMark 4.6) (#1189)
• fix: keep literal backslash before space in link destination (CommonMark 6.3) (#1188)
• 14.3.0 released
• Bump linkify-it / vite deps
• fix: keep backslash-space hard line break (CommonMark 6.7) (#1185)
• Bump vite from 8.0.14 to 8.0.16 (#1181)
• Rework benchmark deps and bump versions
• benchmark => tinybench
• Update CI config
• Added package-lock and updated versions to latest possible
• lint: enable @stylistic/no-multi-spaces rule
• lint => neostandard
• demo: twbs3 => twbs5
• demo: update sample
• demo: don't highlight src/debug tabs
• Update gitignore
• demo: use highlight.js styles from node package
• demo: drop twemoji
• demo: remove jquery & lodash deps
• demo: drop bootstrap JS dependency
• Update publishing hooks
• Setup weekly tracking of pathlogicals in upstream
• Use the same readme for docs
• Drop shelljs dependency
• Port demo to vite build
• Add source maps to build
• rollup => vite
• Reduce dev deps
• Update coverage gen and upload
• Convert build test to mjs
• jest-worker => Worker
• mocha => native node tests
• Reduce spec tests output
• Simplify builds
• Split tests

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 1ae6a74a-e566-4bfd-b41e-b3943364ec3f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
6 Security Hotspots
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE